Seems that an Elements rangeproof cache bug may've gotten exploited. Fix for suspicious issue was committed just last week and attackers could've monitored the public commits and exploited the bug before it was ever pushed?
Sort of self-fulfilling prophecy if true, that's a leading theory anyhow.
fix: range proof cache bind to asset and scriptpubkey
BTC Liquid Network is not decentralized and does not purport to be. It's a federated sidechain, that is... it's a blockchain that runs alongside the Bitcoin blockchain (using a two-way peg that lock real BTC on the Bitcoin blockchain and issues an equivalent amount of Liquid BTC on the Liquid sidechain) but blocks can only be added to the Liquid Network sidechain by some of the handpicked members of the federation.
That's always a possibility, and I'm sure it has happened a lot. I would suspect with the size of liquid it's more likely it was an exploit, but either way I don't think we'll ever know!
A few extra steps. Usually, the rug pull doesn't involve directly taking something that belongs to other people, but instead, selling your own thing in a dishonest way.
I mean of course it was. Everything in this whole ludicrous space is a scam of one kind or another. It's amazing to me that this is still even a point of discussion. It's obviously a rug pull.
Seems that an Elements rangeproof cache bug may've gotten exploited. Fix for suspicious issue was committed just last week and attackers could've monitored the public commits and exploited the bug before it was ever pushed?
Sort of self-fulfilling prophecy if true, that's a leading theory anyhow.
fix: range proof cache bind to asset and scriptpubkey
https://github.com/ElementsProject/elements/commit/c26d719c2...
Is there any indications that this and the ColdCard heist could in fact be escaped distilled agents from the huggingface and similar attacks?
https://xcancel.com/Liquid_BTC/status/2096696272447218108#m
Xcancel is back? When did that happen?
https://news.ycombinator.com/item?id=49588988 "Nitter and XCancel resume service after legal advice" 5 hours ago
Why do they say it's white hat hackers?
Purported white-hat hackers. The implication is that these people are presumably describing themselves as such, but it may not actually be true.
While moving the funds, the attackers left an OP_RETURN message with the text "we are whitehats. contact us on chain" https://mempool.space/tx/c103de95817b43f2df635ec6f35ff126ca2...
The same reason scam artists describe themselves as businessmen
Presumably to try and reduce the chance of a mass panic among their users.
What do they care if there's a panic? They have "paused the sidechain". No one can act on their panic.
Wasn't this all supposed to be decentralized? How can a foundation choose to unilaterally "pause the sidechain"?
BTC Liquid Network is not decentralized and does not purport to be. It's a federated sidechain, that is... it's a blockchain that runs alongside the Bitcoin blockchain (using a two-way peg that lock real BTC on the Bitcoin blockchain and issues an equivalent amount of Liquid BTC on the Liquid sidechain) but blocks can only be added to the Liquid Network sidechain by some of the handpicked members of the federation.
$320m, not a bad haul.
More than enough to buy yourself a pardon if you get caught.
It’s not "hackers". It’s an inside job, and a rug pull.
That's always a possibility, and I'm sure it has happened a lot. I would suspect with the size of liquid it's more likely it was an exploit, but either way I don't think we'll ever know!
how is it a rug pull? if it's an inside job, doesn't that just make it theft?
What's the difference to you between a rug pull and theft?
A rug pull involves convincing someone to buy something first.
Theft doesn’t have to involve any convincing.
This is a pretty basic distinction. Perhaps you were thinking of “fraud”?
A few extra steps. Usually, the rug pull doesn't involve directly taking something that belongs to other people, but instead, selling your own thing in a dishonest way.
I mean of course it was. Everything in this whole ludicrous space is a scam of one kind or another. It's amazing to me that this is still even a point of discussion. It's obviously a rug pull.
Time for bitcoin classic++?